From 8eeb877adbd3640f6a83f1afc8d81aec68bc0706 Mon Sep 17 00:00:00 2001
From: Sankar Ramalingam <sramling@redhat.com>
Date: Fri, 4 Aug 2017 18:40:06 +0530
Subject: [PATCH] Ticket 49342 - Add regression tests for pwpolicy

Description: PasswordCheckSyntax attribute accepts simple passwords with
cn, sn and uid attributes. This occurs when the fine grained password
policy is configured with nsslapd-pwpolicy-local set to ON.

https://pagure.io/389-ds-base/issue/49342

Reviewed by: ?
---
 .../tests/suites/password/regression_test.py       | 78 ++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 dirsrvtests/tests/suites/password/regression_test.py

diff --git a/dirsrvtests/tests/suites/password/regression_test.py b/dirsrvtests/tests/suites/password/regression_test.py
new file mode 100644
index 0000000..ac90340
--- /dev/null
+++ b/dirsrvtests/tests/suites/password/regression_test.py
@@ -0,0 +1,78 @@
+# Copyright (C) 2017 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ---
+#
+import pytest
+from lib389._constants import SUFFIX
+from lib389.idm.user import UserAccounts
+from lib389.utils import ldap, os, logging
+from lib389.topologies import topology_st as topo
+
+DEBUGGING = os.getenv("DEBUGGING", default=False)
+if DEBUGGING:
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+    logging.getLogger(__name__).setLevel(logging.INFO)
+log = logging.getLogger(__name__)
+
+TEST_USER = 'UIDpwtest1'
+USER_PASW = 'Secret123'
+CN_ATTR = 'CNpwtest1'
+SN_ATTR = 'SNpwtest1'
+UID_ATTR = TEST_USER
+
+
+def test_trivial_passw_check(topo):
+    """PasswordCheckSyntax attribute should reject simple passwords with cn, sn and uid attributes
+
+    :id: bf9fe1ef-56cb-46a3-a6f8-5530398a06dc
+    :feature: Password policy
+    :setup: Standalone instance 
+    :steps: 1. Configure password policy with PasswordCheckSyntax set to on
+            2. Add users with cn, sn, uid, mail and userPassword attributes
+            3. Replace userPassword with cn, sn and uid attribute values
+            4. Check if trivial password is rejected with error 19 
+    :expectedresults: Server should reject if the password contains cn, sn and uid attribute values
+    """
+
+    log.info('Configuring password policy with PasswordCheckSyntax set to on')
+    topo.standalone.config.set('PasswordExp', 'on')
+    topo.standalone.config.set('PasswordCheckSyntax', 'on')
+    topo.standalone.config.set('nsslapd-pwpolicy-local', 'on')
+
+    log.info('Adding user-uid={},ou=people,{}'.format(TEST_USER, SUFFIX))
+    users = UserAccounts(topo.standalone, SUFFIX, )
+    user_properties = {
+        'uid': TEST_USER,
+        'cn': CN_ATTR,
+        'sn': SN_ATTR,
+        'uidNumber': '1001',
+        'gidNumber': '2001',
+        'mail': 'pwtest1@redhat.com',
+        'userpassword': USER_PASW,
+        'homeDirectory': '/home/pwtest1'}
+    tuser = users.create(properties=user_properties)
+
+    log.info('Configuring subtree password policy-{},{}'.format('ou=People', SUFFIX))
+    userdn = 'uid={},ou=people,{}'.format(TEST_USER, SUFFIX)
+    topo.standalone.subtreePwdPolicy(userdn, {'passwordchange': 'on', 'passwordCheckSyntax': 'on'})
+
+    conn = tuser.bind(USER_PASW)
+    attrs = {CN_ATTR, SN_ATTR, UID_ATTR}
+    for attr in attrs:
+        log.info('Replace userPassword attribute with {}'.format(attr))
+        with pytest.raises(ldap.CONSTRAINT_VIOLATION) as excinfo:
+            conn.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', attr)])
+            log.fatal('Failed: Userpassword with {} is accepted'.format(attr))
+        assert 'password based off of user entry' in str(excinfo.value)
+    conn.unbind_s()
+
+
+if __name__ == '__main__':
+    # Run isolated
+    # -s for DEBUG mode
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main("-s {}".format(CURRENT_FILE))
-- 
2.7.4